3b75f616154c97c83c00dba8047d6a47c6babd1b49b2a2ffac535b1c4691c592

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe
Size 6.8MB
Sample260817-ckenvsha73
SHA256 3b75f616154c97c83c00dba8047d6a47c6babd1b49b2a2ffac535b1c4691c592
MD5 78617efe85e64418b8d4b9307f37441f
SHA1 04b0319c54e7dcab249e11d7167ce8873f9c2118
SHA512 f163ca93e23ab99cf7112979ede4e907d24c3449fc947e08cade02c20ca7b020a45d88c552195d663f12c1480d361c2e299a261ca4d28d0162b1f794c9c9662c
SSDEEP 98304:+gwkQ7iIqMD+IQ9zNBmsOqQgDNcEanicl5:+gwk+vFMRB1igDNTanb
TLSH
T186766D0163A480E9F5B7D1788ABAD635EA717C62073053CF16E0E69B1F376E05E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Program crash 64 IoCs

pid	pid_target	Process	procid_target
19436	1268	WerFault.exe
19444	5756	WerFault.exe
19676	3108	WerFault.exe
19684	5556	WerFault.exe
20172	7116	WerFault.exe
20164	7176	WerFault.exe
20156	1444	WerFault.exe
20144	7100	WerFault.exe
19996	3324	WerFault.exe
20180	7012	WerFault.exe
20188	6628	WerFault.exe
20204	612	WerFault.exe
20252	7084	WerFault.exe
20196	6384	WerFault.exe
20212	7208	WerFault.exe
20220	6684	WerFault.exe
20236	7284	WerFault.exe	283
20228	6996	WerFault.exe
20244	7264	WerFault.exe
2520	2020	WerFault.exe
20616	6480	WerFault.exe
20624	2220	WerFault.exe
20704	696	WerFault.exe
20696	6528	WerFault.exe
20664	9116	WerFault.exe
20584	6216	WerFault.exe
20484	6576	WerFault.exe
20568	4556	WerFault.exe
20672	7300	WerFault.exe	284
20440	6512	WerFault.exe
20432	6664	WerFault.exe
20264	7192	WerFault.exe
11176	6496	WerFault.exe
20608	7036	WerFault.exe
20600	6560	WerFault.exe
20592	6168	WerFault.exe
7624	5520	WerFault.exe
20576	5140	WerFault.exe
20560	6720	WerFault.exe
20552	7132	WerFault.exe
7688	6416	WerFault.exe
19452	6284	WerFault.exe
19288	2424	WerFault.exe
19312	4136	WerFault.exe
7532	4924	WerFault.exe
7244	5972	WerFault.exe
7588	6964	WerFault.exe
2484	1752	WerFault.exe
19352	6400	WerFault.exe
7492	7164	WerFault.exe
7556	6860	WerFault.exe
19268	6232	WerFault.exe
19260	2208	WerFault.exe
20472	5928	WerFault.exe
20464	2408	WerFault.exe
20456	2176	WerFault.exe
20448	6700	WerFault.exe
21184	9132	WerFault.exe
21192	9148	WerFault.exe
20840	5756	WerFault.exe
20832	1268	WerFault.exe
19936	6124	WerFault.exe
19928	6464	WerFault.exe
19920	3208	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:788
- C:\USBMonitorSrv.exe
  /i
  2⤵
  PID:4596
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:3220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:2932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:4944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:7284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7284 -s 280
    3⤵
    - Program crash
    PID:20236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:7300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 284
    3⤵
    - Program crash
    PID:20672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:7508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:10440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:8060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8060 -s 288
    3⤵
    PID:39172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:16996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17316 -s 288
    3⤵
    PID:74428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17432 -s 288
    3⤵
    PID:66492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17464 -s 288
    3⤵
    PID:66476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17512 -s 288
    3⤵
    PID:74604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17840 -s 288
    3⤵
    PID:66408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17912 -s 280
    3⤵
    PID:66400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17944 -s 288
    3⤵
    PID:74372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:17992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18064 -s 236
    3⤵
    PID:62948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18200 -s 288
    3⤵
    PID:66460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18272 -s 288
    3⤵
    PID:74224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18640 -s 284
    3⤵
    PID:74276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18792 -s 280
    3⤵
    PID:74700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18944 -s 296
    3⤵
    PID:74364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18976 -s 280
    3⤵
    PID:74316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:18992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19048
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 19080 -s 292
    3⤵
    PID:76692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 19240 -s 288
    3⤵
    PID:74268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:19248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:25788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:25092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:21896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:25348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:25360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:25364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:25796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:25804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:26992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 27052 -s 280
    3⤵
    PID:75996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:27156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35876
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 35892 -s 280
    3⤵
    PID:76496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:35996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:36108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:54968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:54980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:54992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:55016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:55032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:60784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:64664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:72984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:73312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:78992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79048
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:79356

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:9864
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:8820
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:16988
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17004 -s 292
    3⤵
    PID:76988
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17020
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17036
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17060
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17076
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17092
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17108
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17124
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17132
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17156
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17172 -s 288
    3⤵
    PID:68532
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17188
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17204
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17220
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17236
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17248 -s 288
    3⤵
    PID:66444
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17260
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17276
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17292
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17308
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17324 -s 288
    3⤵
    PID:73480
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17340
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17356
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17372
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17388
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17412
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17424
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17440
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17456
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17472
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17488 -s 288
    3⤵
    PID:73472
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17504
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17520
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17536
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17544
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17552
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17560 -s 288
    3⤵
    PID:66468
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17576
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17592 -s 292
    3⤵
    PID:68588
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17600
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17616
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17640
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17648
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17664
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17672
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17696
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17704
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17720
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17736
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17752
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17768
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17784
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17792
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17808
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17832
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17848 -s 288
    3⤵
    PID:74692
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17864 -s 288
    3⤵
    PID:64708
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17880
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 17896 -s 280
    3⤵
    PID:74232
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17904
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17920
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17936
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17952
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17968
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:17984
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18000 -s 288
    3⤵
    PID:74444
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18016 -s 288
    3⤵
    PID:66912
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18032
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18048
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18056 -s 288
    3⤵
    PID:74340
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18072
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18088
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18104
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18120
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18136
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18160
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18176
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18192
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18208 -s 288
    3⤵
    PID:66920
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18224
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18232
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18256
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18280
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18296
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18312
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18328
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18344
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18360
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18376
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18392 -s 288
    3⤵
    PID:66928
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18408
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18424 -s 288
    3⤵
    PID:74460
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 220
    3⤵
    PID:74420
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18448 -s 288
    3⤵
    PID:67152
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18464
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18480
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18488 -s 280
    3⤵
    PID:74388
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18496
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18504
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18520
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18536
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18552
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18560
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18568 -s 292
    3⤵
    PID:74356
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18576
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18592
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18608
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18632
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18648
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18664
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18680 -s 296
    3⤵
    PID:74260
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18688
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18704
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18720
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18736
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18752
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18768
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18784
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18800
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18816
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18832
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18840
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18864 -s 280
    3⤵
    PID:74452
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18880
- C:\Windows\SysWOW64\host.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:14424
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:18896
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:30116
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:30136
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:30152
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32596
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32604
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32612
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32620
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32628
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32636
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32644
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32652
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32660
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32668
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:32676
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:54976
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:54996
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:55008
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:55024
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:55040
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:55064
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60576
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60592
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60600
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60616
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60624
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60656
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60672
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60688
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60704
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60720
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60728
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60744
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60760
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60776
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:60792
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:62456
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72812
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72828
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72844
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72860
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72876
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72892
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72908
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72924
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72940
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72960
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72976
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:72992
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73012
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73036
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73044
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73060
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73076
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73092
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73108
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73124
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73140
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73156
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73172
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73180
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73196
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73212
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73220
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73236
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73252
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73272
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73288
- C:\Daemon.exe
  "C:\yyzUSB.exe"
  2⤵
  PID:73304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 612 -ip 612
1⤵
PID:19280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 280
1⤵
- Program crash
PID:19444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 280
1⤵
- Program crash
PID:19436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 280
1⤵
- Program crash
PID:19684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 280
1⤵
- Program crash
PID:19676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6628 -ip 6628
1⤵
PID:20136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 280
1⤵
- Program crash
PID:19996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 280
1⤵
- Program crash
PID:20144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 280
1⤵
- Program crash
PID:20156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7176 -s 280
1⤵
- Program crash
PID:20164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 280
1⤵
- Program crash
PID:20172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 280
1⤵
- Program crash
PID:20180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 284
1⤵
- Program crash
PID:20188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 280
1⤵
- Program crash
PID:20204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7084 -s 280
1⤵
- Program crash
PID:20252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6384 -s 284
1⤵
- Program crash
PID:20196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7208 -s 280
1⤵
- Program crash
PID:20212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 280
1⤵
- Program crash
PID:20220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 280
1⤵
- Program crash
PID:20228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7264 -s 288
1⤵
- Program crash
PID:20244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 280
1⤵
PID:19912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 280
1⤵
- Program crash
PID:19920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6464 -s 284
1⤵
- Program crash
PID:19928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 284
1⤵
- Program crash
PID:19936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 280
1⤵
- Program crash
PID:20448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 284
1⤵
- Program crash
PID:20456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 284
1⤵
- Program crash
PID:20464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 280
1⤵
- Program crash
PID:20472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 280
1⤵
- Program crash
PID:19260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 280
1⤵
- Program crash
PID:19268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 284
1⤵
- Program crash
PID:7556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7164 -s 280
1⤵
- Program crash
PID:7492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 280
1⤵
- Program crash
PID:19352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 280
1⤵
- Program crash
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 280
1⤵
- Program crash
PID:7588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 280
1⤵
- Program crash
PID:7244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 280
1⤵
- Program crash
PID:7532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 280
1⤵
- Program crash
PID:19312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 280
1⤵
- Program crash
PID:19288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6284 -s 280
1⤵
- Program crash
PID:19452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6416 -s 280
1⤵
- Program crash
PID:7688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 280
1⤵
- Program crash
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 280
1⤵
- Program crash
PID:20552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 284
1⤵
- Program crash
PID:20560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 280
1⤵
- Program crash
PID:20576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 284
1⤵
- Program crash
PID:7624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6168 -s 280
1⤵
- Program crash
PID:20592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 280
1⤵
- Program crash
PID:20600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7036 -s 280
1⤵
- Program crash
PID:20608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 280
1⤵
- Program crash
PID:11176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6480 -s 280
1⤵
- Program crash
PID:20616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7192 -s 280
1⤵
- Program crash
PID:20264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 284
1⤵
- Program crash
PID:20432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 280
1⤵
- Program crash
PID:20440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 280
1⤵
- Program crash
PID:20568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 280
1⤵
- Program crash
PID:20484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 280
1⤵
- Program crash
PID:20584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 280
1⤵
- Program crash
PID:20624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9116 -s 280
1⤵
- Program crash
PID:20664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 7116 -ip 7116
1⤵
PID:20680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6996 -ip 6996
1⤵
PID:20688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 280
1⤵
- Program crash
PID:20696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 280
1⤵
- Program crash
PID:20704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 7012 -ip 7012
1⤵
PID:20760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 280
1⤵
- Program crash
PID:20832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 280
1⤵
- Program crash
PID:20840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7036 -ip 7036
1⤵
PID:20848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6384 -ip 6384
1⤵
PID:21216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9148 -s 280
1⤵
- Program crash
PID:21192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 7264 -ip 7264
1⤵
PID:21208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 6860 -ip 6860
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9132 -s 280
1⤵
- Program crash
PID:21184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7208 -ip 7208
1⤵
PID:21372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1752 -ip 1752
1⤵
PID:22188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6168 -ip 6168
1⤵
PID:23052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6964 -ip 6964
1⤵
PID:22868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5972 -ip 5972
1⤵
PID:23188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4924 -ip 4924
1⤵
PID:22472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 6216 -ip 6216
1⤵
PID:23196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 5520 -ip 5520
1⤵
PID:24168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2208 -ip 2208
1⤵
PID:24280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 7164 -ip 7164
1⤵
PID:24408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1168 -p 6400 -ip 6400
1⤵
PID:24568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 6232 -ip 6232
1⤵
PID:24472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 5140 -ip 5140
1⤵
PID:24648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 2408 -ip 2408
1⤵
PID:24944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1228 -p 5928 -ip 5928
1⤵
PID:25124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1224 -p 2176 -ip 2176
1⤵
PID:25312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1272 -p 7084 -ip 7084
1⤵
PID:25756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1288 -p 6720 -ip 6720
1⤵
PID:25968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1248 -p 7192 -ip 7192
1⤵
PID:26124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1332 -p 7132 -ip 7132
1⤵
PID:26612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1348 -p 6664 -ip 6664
1⤵
PID:27456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1360 -p 7176 -ip 7176
1⤵
PID:27572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1364 -p 7100 -ip 7100
1⤵
PID:27760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 4556 -ip 4556
1⤵
PID:27812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1420 -p 6700 -ip 6700
1⤵
PID:27872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1444 -p 6576 -ip 6576
1⤵
PID:27884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1424 -p 3324 -ip 3324
1⤵
PID:28004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1468 -p 6512 -ip 6512
1⤵
PID:28240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1448 -p 6124 -ip 6124
1⤵
PID:28180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1508 -p 3208 -ip 3208
1⤵
PID:28932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1484 -p 6464 -ip 6464
1⤵
PID:28588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10696 -s 288
1⤵
PID:30144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1572 -p 5556 -ip 5556
1⤵
PID:36140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1560 -p 7300 -ip 7300
1⤵
PID:36156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 280
1⤵
PID:36220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6284 -ip 6284
1⤵
PID:36300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1568 -p 2220 -ip 2220
1⤵
PID:36316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 280
1⤵
PID:36208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7740 -s 284
1⤵
PID:36288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1612 -p 6496 -ip 6496
1⤵
PID:36448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1540 -p 2424 -ip 2424
1⤵
PID:36456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 288
1⤵
PID:36696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1620 -p 2020 -ip 2020
1⤵
PID:36704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1656 -p 1444 -ip 1444
1⤵
PID:37036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 280
1⤵
PID:37168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7284 -ip 7284
1⤵
PID:37176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6560 -ip 6560
1⤵
PID:37272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7748 -s 288
1⤵
PID:37304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1692 -p 6416 -ip 6416
1⤵
PID:37312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 280
1⤵
PID:37364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1708 -p 9116 -ip 9116
1⤵
PID:37392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1640 -p 4136 -ip 4136
1⤵
PID:37456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1732 -p 9132 -ip 9132
1⤵
PID:38256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1756 -p 9148 -ip 9148
1⤵
PID:38300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10652 -s 292
1⤵
PID:38308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 288
1⤵
PID:38356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8832 -s 288
1⤵
PID:38396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8872 -s 288
1⤵
PID:38404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 288
1⤵
PID:38428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10072 -s 288
1⤵
PID:38520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10896 -s 288
1⤵
PID:38528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 232
1⤵
PID:38316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10884 -s 288
1⤵
PID:38324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9880 -s 288
1⤵
PID:38332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10912 -s 288
1⤵
PID:38536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 288
1⤵
PID:38340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10704 -s 288
1⤵
PID:38544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10352 -s 292
1⤵
PID:38348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10140 -s 288
1⤵
PID:38552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10436 -s 288
1⤵
PID:38364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11252 -s 288
1⤵
PID:38560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9976 -s 288
1⤵
PID:38372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10036 -s 288
1⤵
PID:38380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10924 -s 288
1⤵
PID:38388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10412 -s 292
1⤵
PID:38568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9788 -s 288
1⤵
PID:38412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10384 -s 288
1⤵
PID:38420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10068 -s 288
1⤵
PID:38436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11004 -s 228
1⤵
PID:38444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8960 -s 288
1⤵
PID:38452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 8124 -ip 8124
1⤵
PID:38592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10376 -s 288
1⤵
PID:38600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10660 -s 288
1⤵
PID:38608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10388 -s 288
1⤵
PID:38616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11260 -s 288
1⤵
PID:38632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10228 -s 288
1⤵
PID:38640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8924 -s 288
1⤵
PID:38648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8948 -s 288
1⤵
PID:38656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8940 -s 292
1⤵
PID:38668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10684 -s 300
1⤵
PID:38684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10888 -s 288
1⤵
PID:38692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10612 -s 288
1⤵
PID:38584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11148 -s 288
1⤵
PID:38816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11032 -s 288
1⤵
PID:38824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9964 -s 288
1⤵
PID:38832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 288
1⤵
PID:38576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9956 -s 288
1⤵
PID:38720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10404 -s 288
1⤵
PID:38676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 284
1⤵
PID:38808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 10696 -ip 10696
1⤵
PID:22460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10620 -s 288
1⤵
PID:38840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11040 -s 288
1⤵
PID:19284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10236 -s 288
1⤵
PID:37412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3640 -ip 3640
1⤵
PID:22496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 4888 -ip 4888
1⤵
PID:7884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7740 -ip 7740
1⤵
PID:37032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10084 -s 288
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 280
1⤵
PID:38892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10644 -s 288
1⤵
PID:38848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10892 -s 292
1⤵
PID:38624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10088 -s 288
1⤵
PID:39064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5988 -ip 5988
1⤵
PID:39072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8012 -s 288
1⤵
PID:21208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 288
1⤵
PID:39120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7612 -s 288
1⤵
PID:39128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10712 -s 288
1⤵
PID:39136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10152 -s 288
1⤵
PID:39144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 10068 -ip 10068
1⤵
PID:39188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 7748 -ip 7748
1⤵
PID:39164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1796 -p 10896 -ip 10896
1⤵
PID:39616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7580 -ip 7580
1⤵
PID:39652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 7328 -ip 7328
1⤵
PID:39724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 10884 -ip 10884
1⤵
PID:40124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1968 -p 9880 -ip 9880
1⤵
PID:61344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13580 -s 280
1⤵
PID:54816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 10436 -ip 10436
1⤵
PID:56044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 10140 -ip 10140
1⤵
PID:21408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 2840 -ip 2840
1⤵
PID:22112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13692 -s 288
1⤵
PID:20692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 10352 -ip 10352
1⤵
PID:36520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10036 -ip 10036
1⤵
PID:61560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 9976 -ip 9976
1⤵
PID:61584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 8872 -ip 8872
1⤵
PID:61596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2024 -p 9788 -ip 9788
1⤵
PID:61716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 8832 -ip 8832
1⤵
PID:61656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 10924 -ip 10924
1⤵
PID:61664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2008 -p 10412 -ip 10412
1⤵
PID:61872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 10384 -ip 10384
1⤵
PID:62208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2064 -p 4104 -ip 4104
1⤵
PID:62328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2100 -p 10652 -ip 10652
1⤵
PID:62444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2068 -p 10072 -ip 10072
1⤵
PID:62408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16932 -s 284
1⤵
PID:62616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16876 -s 288
1⤵
PID:62672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1616 -p 11004 -ip 11004
1⤵
PID:62692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2132 -p 10612 -ip 10612
1⤵
PID:62700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2148 -p 8960 -ip 8960
1⤵
PID:62840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16396 -s 288
1⤵
PID:62976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2200 -p 10376 -ip 10376
1⤵
PID:62984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2164 -p 11148 -ip 11148
1⤵
PID:63036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16692 -s 280
1⤵
PID:66392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16836 -s 288
1⤵
PID:66428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16780 -s 288
1⤵
PID:66484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2104 -p 10660 -ip 10660
1⤵
PID:73508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14072 -s 280
1⤵
PID:74200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14064 -s 280
1⤵
PID:74240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14156 -s 280
1⤵
PID:74284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14096 -s 280
1⤵
PID:74292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14112 -s 284
1⤵
PID:74300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14440 -s 280
1⤵
PID:74308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16388 -s 288
1⤵
PID:74324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7900 -s 280
1⤵
PID:74348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14788 -s 284
1⤵
PID:74380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14488 -s 280
1⤵
PID:74396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14368 -s 284
1⤵
PID:74404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14400 -s 228
1⤵
PID:74412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14556 -s 284
1⤵
PID:74436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2328 -p 9956 -ip 9956
1⤵
PID:74208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16420 -s 288
1⤵
PID:74216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1668 -p 10404 -ip 10404
1⤵
PID:74468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14144 -s 280
1⤵
PID:74492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14088 -s 284
1⤵
PID:74500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14676 -s 284
1⤵
PID:74508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14248 -s 284
1⤵
PID:74516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2336 -p 8940 -ip 8940
1⤵
PID:74564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16652 -s 288
1⤵
PID:74572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 280
1⤵
PID:74332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 10888 -ip 10888
1⤵
PID:74580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16524 -s 288
1⤵
PID:74596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8756 -s 280
1⤵
PID:74612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 10684 -ip 10684
1⤵
PID:74588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16940 -s 288
1⤵
PID:74476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2304 -p 10388 -ip 10388
1⤵
PID:74684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2120 -p 10892 -ip 10892
1⤵
PID:74708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14588 -s 236
1⤵
PID:74716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 8948 -ip 8948
1⤵
PID:74624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1828 -p 8924 -ip 8924
1⤵
PID:75444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2140 -p 11260 -ip 11260
1⤵
PID:75804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1832 -p 11252 -ip 11252
1⤵
PID:75748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 10228 -ip 10228
1⤵
PID:75872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 10084 -ip 10084
1⤵
PID:76044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2404 -p 9964 -ip 9964
1⤵
PID:75984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2408 -p 10152 -ip 10152
1⤵
PID:76236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2440 -p 11032 -ip 11032
1⤵
PID:76160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2464 -p 10712 -ip 10712
1⤵
PID:76328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2488 -p 10236 -ip 10236
1⤵
PID:76448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2384 -p 8060 -ip 8060
1⤵
PID:76452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33520 -s 284
1⤵
PID:76552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 32120 -s 280
1⤵
PID:76568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33568 -s 280
1⤵
PID:76504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 34968 -s 284
1⤵
PID:76616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 30364 -s 280
1⤵
PID:76560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33424 -s 284
1⤵
PID:76640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33860 -s 280
1⤵
PID:76748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 34508 -s 284
1⤵
PID:76628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33900 -s 280
1⤵
PID:76804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15140 -s 280
1⤵
PID:76836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33240 -s 280
1⤵
PID:76648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33096 -s 280
1⤵
PID:76656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 32912 -s 280
1⤵
PID:76664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33472 -s 280
1⤵
PID:76672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33648 -s 280
1⤵
PID:76732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33312 -s 280
1⤵
PID:76928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33664 -s 280
1⤵
PID:76828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33136 -s 284
1⤵
PID:76952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33400 -s 280
1⤵
PID:76096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 32992 -s 280
1⤵
PID:76812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 32880 -s 284
1⤵
PID:27660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33112 -s 236
1⤵
PID:76820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33892 -s 296
1⤵
PID:76716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33844 -s 280
1⤵
PID:76740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 32976 -s 284
1⤵
PID:76996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33144 -s 280
1⤵
PID:76868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33160 -s 280
1⤵
PID:76860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33760 -s 280
1⤵
PID:77584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33128 -s 280
1⤵
PID:77592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33696 -s 280
1⤵
PID:77600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 32960 -s 284
1⤵
PID:77616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1876 -p 11040 -ip 11040
1⤵
PID:77624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33216 -s 280
1⤵
PID:76876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33932 -s 280
1⤵
PID:76884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 34004 -s 280
1⤵
PID:76892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33924 -s 280
1⤵
PID:76900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33296 -s 280
1⤵
PID:76764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33080 -s 280
1⤵
PID:76756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33280 -s 280
1⤵
PID:76772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33720 -s 280
1⤵
PID:76920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33184 -s 296
1⤵
PID:76792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33828 -s 280
1⤵
PID:76936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33868 -s 280
1⤵
PID:75948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 34044 -s 280
1⤵
PID:76960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15920 -s 288
1⤵
PID:76972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33488 -s 280
1⤵
PID:76724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33168 -s 280
1⤵
PID:76852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33008 -s 280
1⤵
PID:76700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 31576 -s 280
1⤵
PID:77632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1860 -p 3052 -ip 3052
1⤵
PID:76780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 30376 -s 280
1⤵
PID:76908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 29656 -s 280
1⤵
PID:77640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33408 -s 280
1⤵
PID:77608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33152 -s 280
1⤵
PID:77576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33392 -s 236
1⤵
PID:77776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 33852 -s 280
1⤵
PID:76944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2524 -p 10088 -ip 10088
1⤵
PID:77768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2560 -p 8012 -ip 8012
1⤵
PID:77940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 484ff8ea8e6ccc3d31671636fd05d0a3ec2642499dda7138f3d8b0b8c753320f
MD5 ec0b7c9826979a5be56d7d4b062d748a
SHA1 5e22683becb46ca2547434b555279c5164bea16e
SHA512 054795373253e418d5434e93f16f327cdb4c092375bbb9c0f0eb4a8a3585c6d359e244db10da60fad60f7934ef1f11b58af0b726d98438383f7ce8f0abd4dd44
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1ayhmzkq:WJY5HmqRr6FoYpDan8q+86lIEj
TLSH
T191A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 3cad314d0f73c5acfeaf6b9bc6ee4f591e3e2ec96aeb49a202c62d5d020ed05e
MD5 5744fcff4a92e58469a91defe0608c9b
SHA1 eba4680b0720f7c51e2e9095a8e665d0b7f0c6ac
SHA512 2e2299f60ef9a710015424a6ced353e0b4f41850f9a295cd37c5e5ce5a5fde519e4c774a1ff6909ffa694752f8f28ed8f9f8c4aa2bface9549930c8518f6dca3
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T169E45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.6MB
SHA256 36d1fc363fe172853c83023d4ee0908ed41abf61a930fbd9b1e9e139651d98eb
MD5 32673c1a426c7f6d10a87604989562cb
SHA1 459982dfdd99026eb37930a0cb3b475ff6104926
SHA512 e5df3000e4acf1b8a5bddd617f79e924f2664549c4884d3d764107b6a39c6498dcdf7a0d943d8c0abdd5c86554655b4c4643da9f94e8fe70f80a33442fd87c03
SSDEEP 49152:XENwzIR257BsIqR6FoKvku04YLxVO88hXl+:XgwkQ7+IqMDL/h1+
TLSH
T1F4D55B10F7608025F5B391B58AEAE1ACE9393CB0876890CB61C5B7FD1A366E16D33357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.0MB
SHA256 6561559f9e46003425666bc2ce0bfb6b8e28f8b6481e31e26adec0f5b74a35ff
MD5 b9fe1b6a40474ad69660646317ecbfba
SHA1 c60d0c36489b6ed38c7fe181681b926ced0d8a5a
SHA512 77b29ecfcb5f26922b9d17e0edebf5444f62e009904a6c2afe9dd3324cbb655e14dec97a0fc630b8bf6731a98f2193fa782efc86f957e55f23b26c5739dd7522
SSDEEP 24576:SENJKEt6dq8hXj8R2vxW870KHNe5GqR6FokG8MCvz44sLy0aZJQ5Te6LVai:SENwzIR257BMIqR6FoKvku04YL
TLSH
T1A3A53910AB508029FAF752F55AADE1BC951C7DF0879860CBA1D577FA46362F02D3328B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.1MB
SHA256 f7003a9473bcb616a5dbca59b4f9911823d906b8f555e1ba4ceed81d2eadd5bb
MD5 0be50fd3c8b8bfc7eb1037a57a25f703
SHA1 41450e7bd509fbbc8f65e4c341f21d0d80926a2c
SHA512 052be2e76052d0d1eb4d910862868b84c004e0c0e1a6806ea95c5a8bd95314ba8e71a24cfb5412d9b2c5c342a30e2e1d255964ed5931835b5b8ee77eb80c8394
SSDEEP 24576:EENJKEt6dq8hXj8R2vxW870KHke5GqR6FokG8MCvz44sLy0aZJQ5Te6LGB:EENwzIR257BnIqR6FoKvku04YL
TLSH
T17FA54A10E7508028FAEE52B5CBADE168B51B7DB087D860CBA1D5F6FE47352E02D72247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.2MB
SHA256 90dcdc75483a06f47bae8e7ba49f61a392150bdae0ab75503d4d86427dff83a4
MD5 ca445e68dfda54598b077e662640ecf8
SHA1 3cfeb4e13afc809722fe2c05533a3d2986dc84cd
SHA512 f94ebfc3b4c38c9c17c86179f51f2f27bdfbd89cb48dde48f44c65c51118e03261f8a6c9a3c0979c7d0691c270ff4fc7b027ec308e1a4abe2ccebb5acc9ee7ea
SSDEEP 24576:sENJKEt6dq8hXj8R2vxW870KHwe5GqR6FokG8MCvz44sLy0aZJQ5Te6LFXYfDtcm:sENwzIR257BTIqR6FoKvku04YLQtc
TLSH
T1A7B55B10B7508028FEF752F55AADE16C95297CF08798A0CBA1D577FA4A362E02D37387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.1MB
SHA256 0b285fbdae0be304b5edbec570128b82f0505614e2f6911a527a098da07ce224
MD5 99e81abd6ec5117c46de8058e40fc843
SHA1 63d33878f2b7a485484794e5e8b491b6a4af8efb
SHA512 3eaa9e8c7563adfc07cb0173fa0ae2427e63be03b1668076e6e16b541ce5f0a2e25391f720ad778d84fb0e9bdd08ba5b9c0be6f5b40d465e6d6e33f019f68f1d
SSDEEP 24576:EENJKEt6dq8hXj8R2vxW870KHke5GqR6FokG8MCvz44sLy0aZJQ5Te6Ld6Iab:EENwzIR257BnIqR6FoKvku04YLd6I
TLSH
T1C3A54A10BB508028FAE752F55AAEE178952C7DF0879860CBB1D577FA46366F02D33287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.0MB
SHA256 b38dfb3271ec89f166fa49961e9e610613ec4fce4131b0dff07cb9969c35ce40
MD5 3ef225fdd33e67c6c03bd75fb9137aa1
SHA1 ca27d39d8c739a4b0fce00c8785640c347f5e177
SHA512 eb88f40d2cfac8a00d24b8901c32bbe3e9c73eb26aec3e37fe8e3be2181260c570e054570db8da7fd84c3fd0221da1beff054ef95a7a4670d5422b6138e1ba29
SSDEEP 24576:FENJKEt6dq8hXj8R2vxW870KHfe5GqR6FokG8MCvz44sLy0aZJQ5Te6LMY:FENwzIR257B2IqR6FoKvku04YLM
TLSH
T1C0A54A10AB508028FAE762F55AADE1BC941C7DF08B9860CBA1D577FE46352F12D33297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.9MB
SHA256 03c817a2f577a75c059ba248d1f6c6ed49438314db7df9ec7b8966a15800c7b8
MD5 d8dc8a82b393dac77cca3bb5fc1f728f
SHA1 89ab590a954522af57ba353e8053a78db5872363
SHA512 7c8f8f883425ce6d57c366ee1802a027e16972ea3face4b0971189878682d8daa57e6c71aac6516016f575e960dd4e41720fecb27bbb0863c15a12aa00c46388
SSDEEP 49152:tENwzIR257BUIqR6FoKvku04YLi/ezSC6vUzPvMHjy:tgwkQ7OIqMDbezSC6v2XMH
TLSH
T12EE54B10F6708126F5F391F5CAEAA2ACE9353CA1476440CB61C6B7FD1A366E15D3232B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.5MB
SHA256 63b7d5db28c9039fefb6a35ca838c05e8ed346dea05b760104d036d12188be83
MD5 9cd96a407f7c12a92d94c84c9c87ccf3
SHA1 9a054e9ad521a41c376ba2630065765e3c6cf3e9
SHA512 efad258643ef41e9c8744da0284290908ec6ee553d5609bae8ef4c2fb34b682a5efa3f636f133f55fb037f89bb9f511dd290924f183d88e9f60d45c6bbde47de
SSDEEP 49152:MENwzIR257BwIqR6FoKvku04YLNPji0Aj:MgwkQ76IqMDmjo
TLSH
T1BEC55B10F7608024F9B391F58AEAE2ACE5293CB0476890CBA1C5B7FD5A366E15D33357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.5MB
SHA256 aef4e665df2397ee069758763ec48802dd2a7d0a62fb1629b516994ad99bcac0
MD5 884c6879808d39da6daa7a9ba1a0cf4a
SHA1 8fbe41f853d61c0748a0d8a9d6b73a77675775b7
SHA512 dbb212ba699c9957fe81f268b75ba0c2951482241b532b3a5f54be53f8897d6132025005627130fdf324aeb7609919502d04874d2ba37d008e3540e7fb975b38
SSDEEP 49152:XENwzIR257B7IqR6FoKvku04YLZdNXhn4:XgwkQ7FIqMDEHn4
TLSH
T11DC57D10FB51C028FAA781F54AAEE178A4297CF0476860CBB1D977F95A356F02E36347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.1MB
SHA256 4a2971feca6a904d45544d687beaced42e9bf8f6d07c2612e422fff5050d66fe
MD5 7b5e4032d263a4e07e74178beec9775e
SHA1 c40ee58462d7d6c533f25f867b00bf50a066ebea
SHA512 f51ff9ce8b991cbac170030ad551b32ce1493eed2904b561ada97b045a59f61c725236397d99c8f488e592af46bf8721e8340031f5823efd337cc65d5daee47f
SSDEEP 24576:vENJKEt6dq8hXj8R2vxW870KHee5GqR6FokG8MCvz44sLy0aZJQ5Te6LCT6mpv:vENwzIR257BBIqR6FoKvku04YLCTPp
TLSH
T12EA54B10AB508029FAF752B55ABDE1BC952C7DF0879860CBB1D577F946362E02D3328B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.0MB
SHA256 9d05780a967e13abda1d7d2dba9e0dcd6c441b7c72295620ac08430085f5025d
MD5 676d254c657ace3f65bbfd7912b52c23
SHA1 10b2b3d944b614f7f42d3d83c326bd1617a5e15d
SHA512 1ca9f6a3219a4b56a07dd40bb50af86d7ff113ed8315880ab76899298456df39814e4d544157864de073bcb9d354c6f269d0888dc85447c67fca7c11c176112f
SSDEEP 24576:PENJKEt6dq8hXj8R2vxW870KHce5GqR6FokG8MCvz44sLy0aZJQ5Te6LsE:PENwzIR257B/IqR6FoKvku04YL
TLSH
T11CA53A10AB508029FAE752F55AAEE1BC951C7DF0879860CBB1D577FA46362F02D33287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-3-0x0000000000EA0000-0x00000000015CC000-memory.dmp

Download

memory/788-5-0x0000000000FB2000-0x0000000000FB3000-memory.dmp

Download

memory/1012-478-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/3720-472-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/3788-513-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/3824-528-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4128-465-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4196-496-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4596-10-0x0000000000110000-0x0000000000206000-memory.dmp

Download

memory/5660-140-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/5896-463-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/6040-489-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/6528-579-0x0000000000400000-0x000000000049C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads